Fortify integration with Maven - install

Question

I want to run a Fortify scan against a Maven Eclipse project.

Where should I start?

I understand that I need to update my pom.xml file to include the Fortify plugin however do I also require to have Fortify SCA installed on my machine? (I'm running MacOS X). I have been trying to find a place to download Fortify SCA but have not been able find it.

I would appreciate it if someone could share some links to point me in the right direction in getting the setup complete.

Answer 1

Actually profiles are not needed, only the plugin configuration.

<build>
    <plugins> 
        <plugin>
            <groupId>com.fortify.ps.maven.plugin</groupId>
            <artifactId>sca-maven-plugin</artifactId>
            <version>4.30</version>
            <configuration>
                <findbugs>true</findbugs>
                <htmlReport>true</htmlReport>
                <maxHeap>800M</maxHeap>
                <source>myJavaVersion</source>
                <buildId>myBuildId</buildId>
                <verbose>true</verbose>
                <skipTests>true</skipTests>
                <toplevelArtifactId>myTopLevelId</toplevelArtifactId>
            </configuration>
        </plugin>
    </plugins>
</build>

By using a single Jenkins job you can write, as a pre-step, a shell script:

mvn clean sca:clean -DskipTests
mvn sca:translate -DskipTests

And then define the actual "Goals and options" as:

install sca:scan -DskipTests

Having them as separate command lines is the only way to have the sca-clean,translate and scan (and report file sending to Fortify) done in one Jenkins job.

Hope this works for you too!